shellcheck

Lint shell scripts using upstream shellcheck.

Configuration

- id: shellcheck
  args: ["-x"]   # default — follow source statements

Category 1 (static binary download). Source: hooks/shellcheck/run.sh.